This is not rocket science. They probably store it encrypted, and decrypt in RAM when they need to validate things like that. It's not the first company to have this restriction. I know some companies that prevent parts of day names in the password, for example.